Your Email Address Is Semi-Public, So Audit Where It Leaks

Is your email address public? Wrong question. It is semi-public by design: handed to companies on signup forms, scraped off public pages, traded through broker chains, and dumped whenever one of those companies gets breached. I run AliasFleet, an email-alias service, and this page is the audit I point people at. The question that matters is not whether your address is out there. It is which of your addresses is exposed, and whether you can kill that one without touching the rest.

You probably have one address you have used for everything since 2014. That is the one we are auditing. And the fix at the end is structural: one address per site, so each exposure names its source and can be switched off. First, the map of the damage.

Breach dumps are the biggest supply line

Have I Been Pwned currently lists 1,047 breached websites holding 17,846,550,965 compromised addresses. Every one of those addresses came from someone typing it into a signup form. That is what makes a breached address valuable: it is known-active. The signup you made in 2014 is still working for someone in 2026, because breach files do not expire. They get copied, sold, and re-sold for years, and the same address keeps producing junk long after the company involved has moved on.

Start there because it is the easiest to check and the hardest to fix. Our guide to checking whether your email leaked walks through reading each result properly, including the breach flags HIBP attaches. For how these files escape companies in the first place, see how data breaches happen. And if typing your own address into a breach search feels wrong, we answered that separately.

The brokers who never met you

Separate from the criminals, there is a legal industry that assembles your address without any hacking. The FTC's 2014 study of nine data brokers found one broker holding 1.4 billion consumer transactions and 700 billion data elements, with another adding 3 billion data points every month. Seven of the nine were sharing data with another broker in the study. Your address rides along with loyalty-card purchases, warranty registrations, magazine subscriptions, and public records, then lands in a people-search profile on a site you never visited. Three or four companies can handle your address before the first spam arrives, and none of them ever met you.

Enforcement is real and slow. In May 2026 the FTC moved to permanently bar broker Kochava from selling precise location data without explicit consent. In 2020 the UK's ICO ordered Experian to fundamentally change its marketing data business after finding "invisible processing" of people's data. Our data broker explainer covers the full chain.

The FTC can fine a broker and the ICO can order one rebuilt. Neither action deletes your address from the files already sold and re-sold. Cleanup after the fact is your job. That is what the audit below is for.

Harvester bots read the open web

Before breach databases existed, there were bots. The documented harvesting sources include public forums, staff directories, mailing-list archives (Google Groups is named explicitly), Usenet posts, and WHOIS records. A plain-text address on a public page is the oldest feed there is: a 2016 walkthrough of spammer methods still describes the web as the first place spammers look.

Programmers get a special mention here. Every public commit you pushed to GitHub with your personal email in the git config is still associated with that address; GitHub's own docs confirm that old commits keep the old email even after you change it.

The craftier variant never touches a public page at all. Direct marketers match your name and postal address to an email, a practice called e-pending, and some sites sell your form data to spammers through an HTTP POST the moment you hit submit, splitting the revenue. The harvesting literature calls these the best addresses spammers can get: fresh, and from someone who just proved they buy things.

Google already indexes half of it

Type your address into Google inside quotation marks and you see the public surface exactly as a stranger would: forum profiles, old mailing-list posts, PDF newsletters, directory listings. Google's quoted-search syntax does exact matching, so the results are precise.

Then switch on Google's Results about you. You register your email addresses, and Google monitors search results for them, lets you request removal, and notifies you when new matches appear. Read the fine print on that page before you celebrate: removal only takes the result out of Search. The source page survives. And Google declines removal for results from government and educational sites and newspapers.

The counter you handed it over at

One channel has no leak in it at all, because nothing leaked: you handed the address over and the site sold it. The form-data-sold-at-submit practice from the harvesting literature is the freshest supply traders get, because the person just proved they engage. No breach check finds this, because no breach happened. No broker opt-out touches it, because the transaction was the signup itself. This is the channel that makes "one address for everything" expensive: a single address, reused for a decade, is a single asset you keep giving away.

Make exposure containable, not permanent

You cannot un-publish the past. You can stop every new exposure from being your main address. An email alias is a separate forwarding address that exists for one relationship: one site gets one address, and mail to it lands in your inbox. The privacy logic is simple, and it runs on the sources above in reverse. The piece that mapped where spammers get their addresses shows the other side of the same trade: the resale market only works because one address shows up everywhere. When a breach dump surfaces, the breached address belongs to exactly one site, so you know who leaked it. When a broker profile includes an address that was only ever given to one store, you know who sold it. Our leak-tracing guide shows the mechanism: the To field names the source before you even open the mail. And when an address goes noisy, you switch it off in one click without touching your real inbox.

The sources above all feed on one thing: the same address, everywhere, forever. Break that pattern and each leak becomes small, traceable, and killable. That is the entire model behind AliasFleet: managed, persistent aliases, one per site, under your control. Setting one up takes a couple of minutes, and the one-address-per-site habit is the whole system. It does not scrub a decade of exposure. It makes every exposure from today forward somebody else's dead end.

Run the 15-minute exposure audit

Fifteen minutes, one address at a time. Work in this order.

Step 1: Google the address in quotes. Fastest public-surface scan. Note every page that shows it. Remove or edit anything you control; the rest becomes the URL list you need in step 3.

Step 2: Run Have I Been Pwned. Type the address in, read each breach it names: the date, the count, the data classes. Turn on breach notifications while you are there, so the next one finds you instead of the other way round.

Step 3: Set up Results about you and file removals. Register the address on Google's Results about you tool (linked above), review the matches, and request removal for anything that should not be indexed. Keep expectations honest: de-listing is not deletion.

Step 4: Check the people-search sites and opt out. Search the big brokers for your name and city. When you find a profile, use the opt-out flow. Whitepages' suppression requests are representative of the genre: find your profile, submit, confirm by email, wait, then verify the listing is actually gone a month later. Every broker has its own version, and re-listing is common, so this is maintenance, not a one-time fix.

Step 5: Inventory every account tied to the address. The account-linkage walkthrough shows how to list what you signed up for. Anything dormant that you will never use again: delete the account, or at least change its email to something else. If that address has been yours for a decade, this part stings a little. That is the point of the audit.

What the audit cannot undo

A broker file holding your 2016 address is still circulating after you opt out of that broker's website. A Google removal takes the result out of the index, not off the source page. And HIBP's line about absence of evidence applies to the whole audit: a clean scan means nothing found, not nothing out there. The one move that survives all of this is structural. The address you hand out from now on should never be the address you cannot afford to lose. Everything above is triage. The habit is the cure.